---
title: "Delete API key"
method: DELETE
path: "/api/v1/keys/{keyID}"
tags: ["Keys"]
---

# Delete API key

`DELETE /api/v1/keys/{keyID}`

## Request

- Base URL: `https://api.uptimemonitoring.com`
- URL: `https://api.uptimemonitoring.com/api/v1/keys/{keyID}`
- Auth: HTTP bearer

Deletes an API key. Deletion is rejected while the account has only
one `api_keys` row, but that guard counts raw rows, not usable
(non-revoked) keys — a key freshly rotated out and still in its
grace window still counts. Confirm a working replacement key before
revoking a candidate key.

## Path parameters

- `keyID` integer, required

## Response `204`

Key deleted.

## Other responses

- `400`: Invalid request.
- `401`: Missing or invalid credentials.
- `403`: Account is currently suspended. On `POST /api/v1/monitors`, and on a `PUT /api/v1/monitors/{monitorID}` that changes `url` or `type` (issue #335), this can also be returned by the per-account port-scan heuristic when the triggering request crossed the port-fan threshold inside the sliding window (10 minutes by default; `SCAN_WINDOW`). A host-fan trip does NOT suspend the account — see the 429 response instead.
- `404`: Key not found or belongs to another account.
- `409`: Cannot delete the last key on the account.
- `429`: Per-account dispatcher rate limit exceeded (200 requests/minute). The `Retry-After` header gives the integer seconds until at least one token has refilled. The `X-RateLimit-*` trio reflects the bucket whose rejection produced this response — usually the global 200/min cap; on `POST /api/v1/monitors` a 429 may instead reflect the per-route 20/min creation limit.

---

[API](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api.md) · [All operations](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/llms.txt) · [OpenAPI document](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/revisions/ddcb2a8bc70f?raw)